GST 203 – TECH PRO II COURSE MATERIAL

Introduction to networking

Definition of a network; Introduction to cyber security; attacks, Concepts and techniques;

protecting data privacy; protecting the organization

A Computer network consists of two or more autonomous computers that are linked

(connected) together in order to: Share resources (files, printers, modems, fax machines),

share Application software like MS Office and allow Electronic communication. Increase

productivity makes it easier to share data amongst users. A Computer network includes, the

network operating system on the client and server machines, the cables, which connect

different computers and all supporting hardware in between devices such as bridges, routers

and switches. In wireless systems, antennas and towers are also part of the network.

Computer networks are generally classified according to their structure and the area they are

localised in as:

Local Area Network (LAN): The network that spans a relatively small area that is, in a

single building or campus is known as LAN.

Wide Area Network (WAN): The type of computer network that is designed larger for a

larger area.

The additional characteristics that are also used to categorise different types of networks are:

Topology: Topology is the graphical arrangement of computer systems in a network.

Common topologies include a bus, star, ring and mesh.

Protocol: The protocol defines a common set of rules which are used by computers on the

network that communicate between hardware and software entities. One of the most popular

protocols for LANs is the Ethernet. Another popular LAN protocol for PCs is the token-ring

network.

Architecture: Networks can be broadly classified as using either a peer-to-peer or

client/server architecture.

Communication from a source to a destination, that is, from one computer to another or from

one device to another, involves the transfer of information from the sender to the receiver.

The transfer of data from one machine to another such that, the sender and the receiver can

both interpret the data correctly is known as Data Communication. All communication

between devices requires that the devices agree on the format of the data. The set of rules

defining a format is known as a protocol. At the very least, a communication protocol must

define the following:

1. Transmission media used.

2. Rate of transmission (in baud or bps).

3. Type of transmission (synchronous or asynchronous, half-duplex or full-duplex modes).

Channel

In communications, the term channel refers to a path of communications between two

computers or devices. A communication channel provides everything that is needed for the

transfer of electronic information from one location to another. It may refer to the physical

medium, such as coaxial cable, or to a specific carrier frequency (sub-channel) within a larger

channel or a wireless medium.

The channel capacity of a transmission system is the maximum rate at which information can

be transferred reliably over a given period of time. Two basic types of channels that are used
in voice and data communication are Analog and Digital.

The Analog type of channel transmits signals generally using sinusoidal waves. Non-sinusoidal

waves can also be used for transmission. The commercial radio station and Public telephone

system are examples of this type. Analog signals vary constantly in one or more values; these

changes in values can be used to represent data. An analog signal is continuous and can be

represented by using sine waves. Human voice, video and music are all examples of analog

signals, which vary in amplitude (volume) and frequency (pitch). Human voice generates an

analog (continuously varying) signal containing multiple frequencies that is transmitted as an

analog signal over the medium. Amplifiers are used to overcome the

The Digital type of channel transmits pulsed wave signals. Digital data transmission describes

any system based on discontinuous data or events. Computers are digital machines because at

their most basic level they can distinguish between just two values, 0 and 1, or off and on.

There is no simple way to represent all the values in between, such as 0.25. All data that a

computer processes must be encoded digitally, as a series of zeroes and ones. Information

coming out of the computer is in the form of digital signals. The bandwidth of a digital signal

is infinite as compared to any medium, which has a limited bandwidth. Therefore, as the signal
is generated and enters the medium, at that point of entry, only limited frequencies are

permissible on the medium and this depends upon the bandwidth. As the signal traverses over

the medium it gets distorted and beyond a certain distance, the signal becomes unrecognisable

from the original one. A hardware device called Repeater is used to regenerate the digital signal.

INTRODUCTION TO CYBER SECURITY

"Cyber security is primarily about people, processes, and technologies working together to

encompass the full range of threat reduction, vulnerability reduction, deterrence,

international engagement, incident response, resiliency, and recovery policies and activities,

including computer network operations, information assurance, law enforcement, etc."

Cyber security is the body of technologies, processes, and practices designed to protect

networks, computers, programs and data from attack, damage or unauthorized access. The

term cyber security refers to techniques and practices designed to protect digital data. The

data that is stored, transmitted or used on an information system.

Cyber security is the protection of Internet-connected systems, including hardware, software,

and data from cyber attacks. It is made up of two words one is cyber and other is security.
Cyber is related to the technology which contains systems, network and programs or data.

Whereas security related to the protection which includes systems security, network security

and application and information security.

Why is cyber security important?

Listed below are the reasons why cyber security is so important become a predominant digital

world: Cyber attacks can be extremely expensive for businesses to endure. In addition to

financial damage suffered by the business, a data breach can also inflict untold reputational

damage. Cyber-attacks these days are becoming progressively destructive. Cybercriminals are

using more sophisticated ways to initiate cyber attacks. Regulations such as GDPR are forcing

organizations into taking better care of the personal data they hold. Because of the above

reasons, cyber security has become an important part of the business and the focus now is on

developing appropriate response plans that minimize the damage in the event of a cyber

attack. But, an organization or an individual can develop a proper response plan only when he

has a good grip on cyber security fundamentals.

Cyber Security Fundamentals

Confidentiality: Confidentiality is about preventing the disclosure of data to unauthorized

parties. It also means trying to keep the identity of authorized parties involved in sharing and

holding data private and anonymous. Often confidentiality is compromised by cracking poorly

encrypted data, Man-in-the-middle (MITM) attacks, disclosing sensitive data.

Standard measures to establish confidentiality include: Data encryption, Two-factor,

authentication, Biometric verification, Security tokens.

Integrity

Integrity refers to protecting information from being modified by unauthorized parties.

Standard measures to guarantee integrity include:

Cryptographic checksums

Using file permissions

Uninterrupted power supplies

Data backups.

Availability

Availability is making sure that authorized parties are able to access the information when

needed. Standard measures to guarantee availability include: Backing up data to external

drives Implementing firewalls Having backup power supplies Data redundancy

A cyber-attack is an exploitation of computer systems and networks. It uses malicious code to

alter computer code, logic or data and lead to cybercrimes, such as information and identity

theft. Cyber-attacks can be classified into the following categories:

1) Web-based attacks
2) System-based attacks

Web-based attacks

These are the attacks which occur on a website or web applications. Some of the important

web-based attacks are as follows-

1. Injection attacks It is the attack in which some data will be injected into a web application

to manipulate the application and fetch the required information. Example- SQL Injection,

code Injection, log Injection, XML Injection etc.

2. DNS Spoofing DNS Spoofing is a type of computer security hacking. Whereby a data is

introduced into a DNS resolver's cache causing the name server to return an incorrect IP

address, diverting traffic to the attackers computer or any other computer. The DNS spoofing

attacks can go on for a long period of time without being detected and can cause serious

security issues.

3. Session Hijacking It is a security attack on a user session over a protected network. Web

applications create cookies to store the state and user sessions. By stealing the cookies, an

attacker can have access to all of the user data.

4. Phishing Phishing is a type of attack which attempts to steal sensitive information like user

login credentials and credit card number. It occurs when an attacker is masquerading as a

trustworthy entity in electronic communication.

5. Brute force It is a type of attack which uses a trial and error method. This attack generates

a large number of guesses and validates them to obtain actual data like user password and
personal identification number. This attack may be used by criminals to crack encrypted data,

or by security, analysts to test an organization's network security.

6. Denial of Service It is an attack which meant to make a server or network resource

unavailable to the users. It accomplishes this by flooding the target with traffic or sending it

information that triggers a crash. It uses the single system and single internet connection to

attack a server. It can be classified into the following- Volume-based attacks- Its goal is to

saturate the bandwidth of the attacked site, and is measured in bit per second. Protocol

attacks- It consumes actual server resources, and is measured in a packet. Application layer

attacks- Its goal is to crash the web server and is measured in request per second.

7. Dictionary attacks This type of attack stored the list of a commonly used password and

validated them to get original password.

8. URL Interpretation It is a type of attack where we can change the certain parts of a URL, and

one can make a web server to deliver web pages for which he is not authorized to browse. 9.

File Inclusion attacks It is a type of attack that allows an attacker to access unauthorized or

essential files which is available on the web server or to execute malicious files on the web

server by making use of the include functionality.

10. Man in the middle attacks It is a type of attack that allows an attacker to intercepts the

connection between client and server and acts as a bridge between them. Due to this, an

attacker will be able to read, insert and modify the data in the intercepted connection.

System-based attacks
These are the attacks which are intended to compromise a computer or a computer network.

Some of the important system-based attacks are as follows-

1. Virus It is a type of malicious software program that spread throughout the computer files

without the knowledge of a user. It is a self-replicating malicious computer program that

replicates by inserting copies of itself into other computer programs when executed. It can

also execute instructions that cause harm to the system.

2. Worm It is a type of malware whose primary function is to replicate itself to spread to

uninfected computers. It works same as the computer virus. Worms often originate from email

attachments that appear to be from trusted senders.

3. Trojan horse It is a malicious program that occurs unexpected changes to computer setting

and unusual activity, even when the computer should be idle. It misleads the user of its true

intent. It appears to be a normal application but when opened/executed some malicious code

will run in the background.

4. Backdoors It is a method that bypasses the normal authentication process. A developer may

create a backdoor so that an application or operating system can be accessed for

troubleshooting or other purposes.

5. Bots A bot (short for "robot") is an automated process that interacts with other network

services. Some bots program run automatically, while others only execute commands when

they receive specific input. Common examples of bots program are the crawler, chatroom

bots, and malicious bots.

PROTECTING THE ORGANIZATION

Threats represent potential security harm to an asset when vulnerabilities are exploited -

Attacks are threats that have been carried out whether passive or active.

Passive

Make use of information from the system without affecting system resources

Active Alter system resources or affect operation

Insider

Initiated by an entity inside the organization

Outsider Initiated from outside the perimeter

Computer criminals Computer criminals have access to enormous amounts of hardware,

software, and data; they have the potential to cripple much of effective business and

government throughout the world. In a sense, the purpose of computer security is to prevent

these criminals from doing damage. We say is any crime involving a computer or aided by the

use of one. Although this definition is admittedly broad, it allows us to consider ways to

protect ourselves, our businesses, and our communities against those who use computers

maliciously. One approach to prevention or moderation is to understand who commits these

crimes and why. Many studies have attempted to determine the characteristics of computer

criminals. By studying those who have already used computers to commit crimes, we may be

able in the future to spot likely criminals and prevent the crimes from occurring.

PROTECTION OF ORGANIZATION AGAINST ATTACKS

There are basic ways to protect organizations against cyber attacks

1. Establish a cybersecurity culture: Create a culture of cybersecurity awareness within

your organization by providing regular training to employees on how to identify and
respond to cyber threats. Security awareness training helps ensure that all employees
 understand the importance of cybersecurity and are equipped with the knowledge
and skills needed to protect sensitive data and systems. Encourage employees to
report any suspicious activity or potential threats they encounter.

2. Implement multi-factor authentication: Require multi-factor authentication for all

employees accessing sensitive data or systems. Multi-factor authentication adds an
extra layer of security by requiring users to provide two or more forms of identification
before accessing sensitive data or systems.

3. Encrypt sensitive data: Encrypting sensitive data is like putting it in a secret code to
keep it safe from people who shouldn’t see it. There are two ways we do this: when
the data is “at rest” (meaning it’s stored on a device or server) and when the data is
“in transit” (meaning it’s being sent between devices or servers). By encrypting
sensitive data both at rest and in transit, you can help ensure that it remains secure
and confidential.

4. Conduct regular vulnerability assessments: Conduct regular vulnerability

assessments to identify potential security weaknesses in your organization’s systems
and applications. Vulnerability assessments help identify potential security
weaknesses before cybercriminals can exploit them.

5. Implement intrusion detection and prevention systems: Implement intrusion

detection and prevention systems to detect and prevent cyber attacks. Intrusion
detection and prevention systems monitor network traffic for signs of suspicious
activity and take action to prevent cyber attacks.

6. Establish an incident response plan: An incident response plan is a document that

outlines the specific procedures and steps that should be taken to ensure minimal
impact from a cyber attack. It’s important to establish an incident response plan that
is tailored to your organization’s specific needs and risks. The plan should outline the
roles and responsibilities of everyone involved in the response effort, including IT staff,
security personnel, and management. It should also include a communication plan
that outlines how information will be shared during an incident, both internally and
externally. Establishing an incident response plan can help ensure your organization is
prepared to respond quickly and effectively to cyber attacks.

7. Back up your data: Perform daily (automatic if possible) backups of important

business data and information and store copies either offsite or in the cloud. Critical
data includes digital documents, spreadsheets, databases, financial files, human
resources files, accounts receivable/payable files, and applications.

8. Implement network segmentation: Implement network segmentation to limit the

impact of a cyber attack on your organization’s systems. Network segmentation is the
 process of dividing a computer network into smaller subnetworks, each with its own
security measures.

9. Implement email security controls: Implement email security controls to prevent

phishing attacks and other email-based cyber threats by blocking suspicious emails
and attachments.

10. Stay current on the latest threats: Stay current on the latest cyber threats by
subscribing to industry newsletters, attending conferences, and participating in other
cybersecurity-related events.